Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

An anonymous reader writes "The UK ISP TalkTalk has been caught using a form of Deep Packet Inspection technology to monitor and record the websites that its customers visit, without getting their explicit consent. The system, which is not yet fully in place, ultimately aims to help block malware websites by comparing the URL that a person visits against a list of good and bad sites. Bad sites will then be restricted. TalkTalk claims that its method is totally anonymous and that the only people with visibility of the URL database itself are Chinese firm Huawei, which will no doubt help everybody to feel a lot better (apply sarc mark here) about potentially having their privacy invaded."

In the UK it is illegal to monitor a person priate converstaion on the phone, unless you have a judges authority. Also it's against Human Rights. Maybe Talk-Talk customsers should report them to the police.

Actually in UK law the digital economy act practically requires by law that isp's are to monitor their users and notify certain bodies of any possible illegal activity.
TalkTalk and BT are the only people attempting to stand up to this. I guess TalkTalk are a little more two faced than we thought.

Actually in UK law the digital economy act practically requires by law that isp's are to monitor their users and notify certain bodies of any possible illegal activity.
TalkTalk and BT are the only people attempting to stand up to this. I guess TalkTalk are a little more two faced than we thought.

If it's malware they're trying to stop and not anything else then they gain little.Foolish people who click "OK" to popups asking them to install anything and everything constitute an almost perfectly random search.

Better to just get a list of sites which serve malware from one of the companies which track such things and re-direct traffic for them into a hole.

How is them trying to warn users they area about to visit a malicious site anything like recording activity for the purposes of relaying to the government? There is nothing two faced about this, it is good for the customer.

This is just the usual BS sensationalism. According to TFA, the data being recorded is anonymous:

Our scanning engines receive no knowledge about which users visited what sites (e.g. telephone number, account number, IP address), nor do they store any data for us to cross-reference this back to our customers. We are not interested in who has visited which site - we are simply scanning a list of sites which our customers, as a whole internet community, have visited. What we are interested in is making the web a safer place for all our customers.

This is the type of thing we should be encouraging rather than discouraging, if it reduces the number of idiots infecting their machines, which it will slightly. I think the ISP should enable this type of warning by default, with the option to opt out for those who actually want the very slight improvement in latency.

I agree that it is good in the way that TalkTalk present it, but I'd always be dubious about a) a company's real intentions and b) how they could change it in future so that what it does now isn't quite what it will do then.

Overall, most of the population probably need this kind of help, since they're not familiar enough with what can happen and assume that the web is fairly safe. In reality, there are a good number of things that could go wrong depending on how anonymised, automated and separate their syst

I'm one of those people who can't get ADSL because of my phone line, so I have to use Virgin. If they started doing what TalkTalk are doing I would have no way out of it other than using Tor or a VPN service for everything. I'm sure Tor would have problems if thousands of users suddenly started using it and VPNs are not free.

No, a LOT more two faced. Anyone with even the slightest networking knowledge knows that any ISP such as this, who runs their own DNS server can simply drop the bad domains into the DNS servers and have them point to one of their own servers which will present a "This site has been blocked for... " page.

A simple example of something similar (in implementation) are the "not found" redirects that many ISPs are doing now, that bring you to one of their customized search pages.

"we are concerned that obligations imposed by the Act may not be compatible with important European rules that are designed to ensure that national laws protect users’ privacy, restrict the role of ISPs in policing the internet and maintain a single market." - TalkTalk Blog [talktalkblog.co.uk]

Also, maybe I'm being dumb, but can someone explain to me how knowing the number of people visiting a website is going to help identify malware?

At no point does anything in the Digital Economy Act require ISPs to monitor their users. In fact, if not done anonymously that could well be illegal under European Law (see the Phorm case). The only people that ISPs are obliged to notify of anything under the DEA are subscribers when the ISP has received a Copyright Infringement Report about it.

If you're going to bring up the DEA, I suggest you read up on it first. As it happens, I've spent most of the last few days writing up a guide to the relevant pa

They should indeed report them. It was not "ever thus" and quite demonstrably so because we've only had mass electronic communication relatively recently and in a form that is easy for third-parties to record en masse for substantially less time than that.

Each time a new frontier opens in the eternal war between the rulers and the ruled, a land-grab ensues where governments and corporations try to make the public accept something as inevitable or right whilst at the same time the public realizes just because they've allowed the government to make them do something in other areas, that doesn't mean it was right.

It's vitally important at times like this to defend our rights as forcefully as possible. We did a lot of damage to Phorm when this was tried previously. In fact, Phorm turned into a ugly business black hole that no-one wanted to touch, with a reputation as down the toilet as SCO and I pity the people associated with it (except I don't). Clearly someone hasn't learned their lesson and we need to burn down a few more companies before we finally establish our right to privacy.

Oh noes! Wait a second, your ISP already has access to everything you do online, as well as your real life name, address, bank account number, etc. Why would you suddenly start caring about them having access to that which they already have access to? If they really wanted to do something nefarious with this information, they could.

If you are actually submitting "personal data" that you don't want other people to see or record outside of an encrypted connection, you're an idiot.

An ISP does not need to record and store for long periods of time your history. Nor do they need to then transfer this history on to companies in China. Nor do we necessarily want to allow the precedent of ISPs deciding what sites we may or may not visit to establish any more of a foothold than it already does. What's going on here relates to all of these.

Do you work for TalkTalk or something? Why are you bullshitting so much?

Actually if you look at my comment history you'll see that I do this kind of thing regularly on Slashdot, because people are always sensationalising and bullshitting themselves without actually reading TFA or thinking.

As you point out they probably are already recording sites that have been visited etc. But when they want to do something that could actually be beneficial to the world, you complain.

Yes, I don't think this will make things 100% secure, but it will help make them more secure. It would be simil

I'm not saying that companies won't do these things, but I have seen a lot of Slashdot discussions where people get things completely wrong, working themselves into a frenzy over nothing. I'm just trying to point out how this might not be as bad as the sensationalists are trying to make out.

The Phorm thing does make it more likely that they were trying to screw people over here, I wasn't aware of that until someone else mentioned it.

The personal attack was an emotional response to you saying I'm just bullsh

Forgot to mention, this isn't about privacy, this is about collecting anonymous data. They already have the capability to invade peoples' privacy silently if they really wanted, this is about a public system that they purport to only collect anonymous usage statistics. If they're lying, then it's fine with me to hang them from the rafters, but if they're telling the truth then everyone needs to chill the fuck out.

In the UK it is illegal to monitor a person priate converstaion on the phone... Talk-Talk customsers should report them to the police.

Is that because TalkTalk are recording telephone calls as well? Or perhaps you are suggesting that TalkTalk should be reported for this because there are lots of other unrelated things that they are not doing? Murder would be pretty high up the list I guess, drug running, terrorism....

One thing to add, which you may not have realised if you're not a UK user, is that it is absolutely possible for people to vote with their wallets in this case. Unlike the situation as I understand it in the US, we have a fairly good choice of DSL ISPs.

If a person is using TalkTalk, it means they have a BT (physical) phone line, although it may not be currently connected to BT equipment at the exchange. Since BT has long been required to open up their government-provided-monopoly infrastructure to others, it means that there will be a wide choice of ISPs and switching is relatively straightforward.

Also, on a purely personal note, this allows me a brilliant concrete example of why I advise people to pay a little more for a straightforward, unadulterated connection from Be [bethere.co.uk] or UKFSN [ukfsn.org]'s LLU service (no affiliation with either other than as a satisfied customer) and support those ISPs who don't pull crap like this.

That's fine for geeks who actually take care of their computer, but I welcome moves like this by ISPs to actually make an attempt to stop the proliferation of malware and botnets on machines where the user is clueless. This service is like the "immunise" option in Spybot: S&D, but you don't need to clog up your hosts file or update it every few weeks.

For users that want a direct connection for whatever reason then yes I think voting with the wallet is a good option. I have been saying above that TalkTal

Even when it's not recording any personal information? I think it's vastly preferable to opt the clueless in and let those who care opt out. Leaving the ignorant to secure themselves against things they don't even know exist is really unhelpful. It would be like an email client that comes with no spam filter. Spam filters in Hotmail and Gmail technically have to sift through the contents of your personal emails, but nobody complains about that. To me this seems like a very similar situation.

Yeah I think that's a bit silly, though they might just want usage statistics like how many dodgy/valid/unknown sites people try to visit per month to be able to judge whether it's worth having the filter in place at all.

Well, you need to at least collect the unknown URLs to put into the good or bad database after they scan them, that might be where the "recording URLs" bit comes in.

Seriously, there have been so many stories like this where the comments are murderous and insane, then you find out after RTFA or someone posts a more informed comment that things weren't so bad after all. Then again there have been other comments that mention scummy things TalkTalk have done before so maybe they do have nefarious plans for this

That's true, but it shouldn't be. When are we going to start growing a mesh network that doesn't depend on ISPs? Almost everywhere I go there are several wifi hotspots, and they're almost always private and protected. We should be able to give access to the internet without giving access to our whole computer or data we are transferring ourselves.

Very true, and yet within ten minutes there will still be several hundred posts in this story decrying the evil wiretappers of the man and how this is breach of basic civil liberties.

So here is a question (and it's only half devil's advocate):If you send your data to a private company who has not signed any kind of contract to say that they will keep the data private: why wouldn't they look at it?

Firstly, in the UK, the data protection act [ico.gov.uk] comes into play, especially considering the level of insight that browsing info can give about many of the items listed on the "Sensitive personal data" list.

Secondly, wiretapping legislation specifically forbids monitoring of telephone communications except in specific circumstances, whether they are encrypted or not. It's hardly a stretch to apply the same logic to internet communication.

That's a very cool site, best description of the data protection act that I've read. It still leaves me wondering how the DPI that TalkTalk performed would breach it though. If they pass URLs to a third party without anyway to lookup who requested each URL then it doesn't count as personal data under the act. I also see that any personal data they did pass on would have been legal as long as it was correct and TalkTalk actually told people what they were doing (not that they did).

For the data protection part, I was working on the assumption that they were treating it in a similar manner to that search data that AOL released a few years back (i.e. clustered by user but without a name attached), from which it was straightforward in many cases to extrapolate personal details. The act applies to "data which relate to a living individual who can be identified from those data". Anyway, it seems that I may have been mistaken there, so perhaps it doesn't apply.

I only actually read the article after I replied to you but from the description it does look like just a list of URLs that is being passed over so it probably wouldn't be personal data. There are some corner cases though and TalkTalk have just opened up a huge can of worms as URLs can and do include things like user names.

Expectations of privacy seem to differ wildy. I don't consider myself to be paranoid but I assume that any data being routed across a network can (and will be) freely inspected by any int

a) I'd be concerned about that site and avoid using it anyway, b) that site would be making it a lot easier for you to hack it and c) who is to say that the email address (or thing that looks like an email address) in a URL is related to the URL fetcher? Who's to say it is even real?

The circumstances are more specific than most people think. Basically, unless you are a police force carrying out a criminal investigation, then you are on very shaky legal ground when intercepting communications. From The laws relating to monitoring your employees [out-law.com]:

An employer who controls the system will be open to a civil action from either party to the communication if it intercepts communications without either:

* reasonable belief that both parties to the communication consent to the inte

Except that most phone numbers can't be looked up in slow-time to find out the content that the caller probably saw. It'd be more like "did your phone company sign a contract not to look at the new replacement they have for phone numbers where you dial a number followed by a descriptive string that may or may not give them access to a perfect transcript of what was told to you" (since they'll only get the fetches, not the posts).

Even with encryption, your ISP can log every IP address you access, I would hardly call this a private activity!

So I would correct: nothing you do on the Internet is private, only semi-private with encryption, except if you are using either 1) encryption + TOR or
2) steganography.And (1) is quite easy to detect for your ISP, so you would be "noticed": in some country this could be dangerous..So the only really private communicatio

This actually has some nasty security implications, as it happens. If you visit a non-public part of a website that has a hard-to-guess URL, normally there's no easy way for potential attackers to know. However, if you do it from a Talk Talk broadband connection, now both TalkTalk and Huawei (which is owned by the Chinese government) know it's there, and anyone with access to this information can try and find security vulnerabilities in it which they'd otherwise have difficulty exploiting.

Actually, thinking a bit more, it's worse than that. If you know the URL of a Facebook image, even a private one, you can view the image (there's no access protection on static content like image files) and you can link it back to the Facebook account of the person who posted it. Unless someone's taken special care, this information is very likely to be in TalkTalk's logs.

Ironic this, seeing as how TalkTalk have been pushing back against almost the same things in the Digital Economy Act.

They are against the act because as itis currently written it favours smaller operators, as some of its rules such as the automatic disconnection for copyright violation only apply to ISPs with at least 40,000 customers. They are not fighting the act to protect anyone's privacy, they are fighting the act because it could make their services look less competitive.

Shame really the did look like they might be good guys.

No they didn't, not if you look into their (recent) past. They were one of the big three ISPs connected to the "ex-" spyware outfit Phorm in 2008/2009 and their past sales techniques including line-slamming (using people's details gleaned from other sales activity to switch their landline provision to them without permission) and apparetnyl deliberate ignorance of the Telephone Preference List have left a lot to be desired. See http://en.wikipedia.org/wiki/TalkTalk#Data_pimping [wikipedia.org] and http://en.wikipedia.org/wiki/The_Carphone_Warehouse#Data_protection [wikipedia.org] respectively for links to more info.

Talk Talk good guys??!! The first time I ever heard of them was several years ago when one of their salesmen phoned me to get me to switch my phone service to Talk Talk from BT.

I told him he was breaking the law by cold-calling me because I was registered with the Telephone Preference Service. He then had the nerve to lie that Talk Talk was a subsiduary of BT, and as I was a BT customer he was therefore entitled to ring me.

I did not know at the time whether his claim was true or not, but I told him to f#%k

It's the only way to be sure. I know of at least one German university which also filters all external web traffic through a proxy which blocks URLs, also supposedly to reduce malware infections. The road to hell is paved with good intentions. The same technology which is installed to fight malware is also ideally suited to work as censorship infrastructure. Once it's in place, the operators will undoubtedly be confronted with the question why they only filter malware and not other "illegal" content. Once they've succumbed to that, the list of URLs to block will grow to include "unruly" opinions, videos of police, etc.

There's no reason to suspect it will be different this time than the many times before.

What many times before? Please provide evidence, not assertions.

I can provide a counter-example. Many ISPs in the UK already block access to sites known to host child pornography -- remember the controversy a while back when they blocked Wikipedia? So they've been blocking one type of illegal content for a long time now, and yet somehow they have managed not to slip one single step further down the alleged slippery slo

It always makes me laugh when people attack the messenger too, "tinfoil hat brigade" indeed. And trying to dismiss the message with bitching that the slippery slope isn't steep enough. Your ignorance of history is showing. There are people who are overly paranoid, but there are far too many who are trusting of any perceived authority.

I suppose the biggest reason why we "shoot the messenger" (Ha! As if it's not just created in the messenger's mind!) is that there's typically no evidence presented by the Tinf

Isn't passing personal information out for Europe without expressed permission a breach of the Data Protection Act? Though lets face it, peoples biggest privacy concerns here are their porn viewing habits. Perhaps some porn sites should set up shop that show up in the URL history as stocks and shares or Technology News.

Isn't passing personal information out for Europe without expressed permission a breach of the Data Protection Act? Though lets face it, peoples biggest privacy concerns here are their porn viewing habits. Perhaps some porn sites should set up shop that show up in the URL history as stocks and shares or Technology News.

Anna.Techsupport032a2.jpg, Anna.Techsupport032a3.jpg

There was once a porn site that had a very similar URL to an ADSL comparison site, presumably for that reason. It was particularly annoying when I was trying to find the ADSL site at work...

What just like the valid uk computer hardware store http://www.overclockers.co.uk/ [overclockers.co.uk]
vs the gay porn site. http://www.overcockers.co.uk/ [overcockers.co.uk]
Or at least it used to be years ago when i made an accidental typo infront of my boss at the time:/
At least he did see the honest mistake and saw the funny side of it

What just like the valid uk computer hardware store http://www.overclockers.co.uk/ [overclockers.co.uk]
vs the gay porn site. http://www.overcockers.co.uk/ [overcockers.co.uk]
Or at least it used to be years ago when i made an accidental typo infront of my boss at the time:/
At least he did see the honest mistake and saw the funny side of it

Heh. I think the site in question was adslguide.org.uk or something. The porn site was the same but with co.uk or.com or something more usual. This was about ten years ago, the site seems to have adslguide.com now, no idea if the porn site is still around.

The current UK government, despite borrowing £900bn ($1.4Trillion) and climbing, is not cutting the £10bn+ black-ops DPI upgrade of the UK telephone network, which is in conjunction with BT (who just announced increased charges to their customers and all ISP's to cover the cost).
Why do you think there is such an interest in phones having IP addresses in stead of an ADC?

At least in America all of those pretences went out the window with the PATRIOT act.

The Data Protection Act covers collection of personal data just fine whether digitally or on paper.

It's you [insert tinfoil insult here] people that are fucking stupid when you start bleating about issues like this. It's like the boy who cried wolf. Even when there are serious breaches of privacy going on (and this doesn't count - it is recording anonymised data and therefore isn't even covered under the data protection act,

I don't pretend to have a good grasp of the situation, but you thinking that such things as laws are going to stop naughty people from doing naughty things isn't exactly well thought out either. And with all the "terror" excuses recently both the US and UK governments have taken liberty with the law in the name of security. Laws alone are a poor safeguard against this kind of stuff. It's like putting up a sign on your frontdoor saying "my door is unlocked, but if you open it and steal anything, I shall be v

The thing is, if you ignore the sensationalist headline and look at what there doing, it's just a list of websites that are accessed over their network, which they're using to create an opt in filtering system.

If you read other people's comments you will quickly see why, although this is a Good Thing prima facie, it does have worrying implications that need to be addressed (e.g. the storing of "secret" URLs).

what you actually have is an organisation in a position of trust clandestinely checking up on the websites its users visit.

Whatever their intentions might be, they did this without asking and attempted (though not very effectively) to conceal their actions by passing the information to another part of the operation which did the follow-up accesses. If they were convinced their actions were on the side of right, they would have announced their programme and made their customers aware of what they were doi

I agree absolutely - from reading the article (I know - a completely unfashionable and unforgivable thing to do here on/.) I take this to be very specifically a malware checker, that checks a given site/URL for malware, either directly or uses the cached result of the last check if it was checked within the last 24 hours.

Is this not very similar to the google safe site service that's built into Firefox and other browsers?

Oh, and I love the justification for claiming that it records what customers do... "Th

The thing is, if you ignore the sensationalist headline and look at what there doing, it's just a list of websites that are accessed over their network, which they're using to create an opt in filtering system.

While possibly selling that info to advertisers as well? I mean who is to say what they're doing with it. Of course they'll make some concession and tell you that its good for you.

How, exactly, does deep packet inspection help ISPs to block access to known child porn websites?

If they know about the website, all they have to do is block access to it. There's no need whatsoever for them to examine the content of my communications, if all they're trying to do is block access to certain IP addresses.

Sued by Cisco for nicking their IOS software (settled out of court, but H// withdrew all routing gear and made software changes).
Sued by Motorola (last week) for passing on trade secrets (no idea how valid, but it appears to be a follow on from a case last year, also involving another company called Lemko)
Anecdotally, I've heard of their engineers opening up competitor equipment to take pics while onsite at a customer premises.
Internally, I know they ha

Remarkable that only at the end of the comments (as now, reading +3) I see a comment like this.

Personally I don't see too much problem with the ISP keeping these logs - your traffic passes through them after all, and there may be reasons (legal, technical, whatever) for them to keep such logs.

That a third party, a foreign third party in a jurisdiction not known for its great human rights record nonetheless, has access to this databases is far more worrying. If it is as anonymous as the ISP says it is no i

Presumably they need to capture at least the page that the user is visiting, as checking for malware on just the root of a site is a waste of time. As most sites these days are dynamic they'll also have to capture the parameters in a GET (and possibly POST), so there is every chance they *will* be capturing personally identifiable data.